feat(sbom): add support for scanning a sbom attestation #2652

otms61 · 2022-08-02T01:49:28Z

Description

Support for scanning a sbom attestation.
We can scan a sbom attestation as the following.

$ trivy image --format cyclonedx --output sbom.cdx.json otms61/vuln-python
$ cosign attest --key cosign.key --type cyclonedx --predicate sbom.cdx.json  otms61/vuln-python --no-upload > attest.sbom.cdx.json
$ trivy sbom attest.sbom.cdx.json

Related issues

Close Scan SBOM attestation #2614

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

knqyf263 · 2022-08-03T09:50:20Z

pkg/attestation/attestation.go

+
+	// When cosign creates an SBOM attestation, it stores the predicate under a "Data" key.
+	// https://github.com/sigstore/cosign/blob/938ad43f84aa183850014c8cc6d999f4b7ec5e8d/pkg/cosign/attestation/attestation.go#L39-L43
+	if _, found := st.Predicate.(map[string]interface{})["Data"]; found {


It causes panic if the type assertion fails. Can we make sure the assertion works beforehand?

Suggested change

if _, found := st.Predicate.(map[string]interface{})["Data"]; found {

if cosignPredicate, ok := st.Predicate.(map[string]interface{}); ok {

data, found := cosignPredicate["Data"]

if !found {

return Statement{}, xerrors.Errorf("unsupported predicate format")

}

st.CosignPredicateData = data

Also, we can define our own struct only with needed fields so that we will not have to go back and forth for marshaling/unmarshaling. We can pass json.RawMessage to the SBOM unmarshaler.

trivy/pkg/sbom/attestation/attestation.go

Lines 28 to 31 in 87b2d21

predicateByte, err = json.Marshal(attest.CosignPredicateData)

if err != nil {

return sbom.SBOM{}, xerrors.Errorf("failed to marshal predicate: %w", err)

}

// StatementHeader defines the common fields for all statements type StatementHeader struct { PredicateType string `json:"predicateType"` } // CosignPredicate specifies the format of the Custom Predicate. type CosignPredicate struct { Data json.RawMessage } /* Statement binds the attestation to a particular subject and identifies the of the predicate. This struct represents a generic statement. */ type Statement struct { StatementHeader // Predicate contains type speficic metadata. Predicate CosignPredicate `json:"predicate"` }

Great idea! It will simplify the code!

…or cyclonedx in xml format

knqyf263 · 2022-08-03T12:26:59Z

pkg/sbom/attestation/attestation.go

+		return sbom.SBOM{}, xerrors.Errorf("failed to decode attestation: %w", err)
+	}
+
+	return u.predicateUnmarshaler.Unmarshal(bytes.NewReader(attest.Predicate.Data))


Could you wrap the error by xerrors if it is returned? It adds stack trace and helps us debug.

knqyf263 · 2022-08-04T11:24:10Z

We may want to add an integration test here.

trivy/integration/sbom_test.go

Line 15 in 5b7e0a8

func TestCycloneDX(t *testing.T) {

otms61 · 2022-08-04T12:58:31Z

I have added an integration test.

knqyf263 · 2022-08-08T12:34:25Z

docs/docs/attestation/sbom.md

@@ -32,7 +32,7 @@ $ cosign attest --key /path/to/cosign.key --type spdx --predicate sbom.spdx.json

 # cyclonedx
 $ trivy image --format cyclonedx -o sbom.cdx.json <IMAGE>
-$ cosign attest --key /path/to/cosign.key --type https://cyclonedx.org/schema --predicate sbom.cdx.json <IMAGE>
+$ cosign attest --key /path/to/cosign.key --type cyclonedx --predicate sbom.cdx.json <IMAGE>


We probably should put a note about cosign version as cyclonedx was added in v1.10.0.

I've added a description about cosign version.

knqyf263 · 2022-08-08T12:37:35Z

docs/docs/sbom/index.md

+sbom.cdx.intoto.jsonl (alpine 3.7.3)
+
+Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)


Suggested change

sbom.cdx.intoto.jsonl (alpine 3.7.3)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

sbom.cdx.intoto.jsonl (alpine 3.7.3)

====================================

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

knqyf263 · 2022-08-08T12:39:22Z

pkg/attestation/attestation_test.go

+	"github.com/aquasecurity/trivy/pkg/attestation"
+)
+
+func TestDecode(t *testing.T) {


Suggested change

func TestDecode(t *testing.T) {

func TestStatement_UnmarshalJSON(t *testing.T) {

ChristianCiach · 2023-02-15T11:33:27Z

Heads up: This will probably break with the next Cosign version because this has been merged:

Fix: Drop the CosignPredicate wrapper around SBOM attestations. sigstore/cosign#2718

Especially see the comment sigstore/cosign#2718 (comment)

I still think it is the wrong approach for Trivy to directly support in-toto attestations for the reasons I've specified here: sigstore/cosign#2307 (comment)

knqyf263 · 2023-02-15T11:46:11Z

Thanks for the heads-up. Yeah, we're aware of that. Cosign adds many breaking changes, which is hard for us to follow...

otms61 added 6 commits August 2, 2022 10:45

feat(sbom): add support for scanning a sbom attestation

ae0862b

chore: excecute go mod tidy

6a9cfb6

fix: fix goimports lint errors

8f38112

feat: support for detecting attest xml

c8e2a6b

refactor: move the predicate data access logic to attestation package

50727bb

refacotr: rename cosign predicate data field

87b2d21

knqyf263 reviewed Aug 3, 2022

View reviewed changes

otms61 added 3 commits August 3, 2022 21:06

refactor: define our own Statement structure and remove the support f…

173b381

…or cyclonedx in xml format

Merge branch 'main' into scan_sbom_attest

8e3d190

refactor: fix the comment for Decode function

1be389e

knqyf263 reviewed Aug 3, 2022

View reviewed changes

otms61 and others added 7 commits August 3, 2022 21:55

refactor: wrap the error by xerrors

f461112

test: add a test for Decode attestaions

b6cf89f

test: add a test for Inspect an SBOM attestation

0921717

refactor(cyclonedx): implement json.Unmarshaler

031dd8f

Merge branch 'refactor_sbom' into scan_sbom_attest

3e3438e

test(attestation): fix expected

5838440

Merge branch 'main' into scan_sbom_attest

e2b9200

knqyf263 and others added 2 commits August 4, 2022 14:28

refactor: remove cruft

5db9da3

test: add an integration test for scanning a sbom

03ae38e

otms61 marked this pull request as ready for review August 4, 2022 12:25

otms61 added 4 commits August 5, 2022 09:57

docs: add a descrition for scanning sbom attestation

bf6f0aa

docs: update the cosign --type option

7219892

refactor: use .intoto.jsonl extension

26cce23

docs: use .intoto.jsonl extension

a0a8cf4

knqyf263 reviewed Aug 8, 2022

View reviewed changes

otms61 added 2 commits August 8, 2022 22:05

docs: respond to PR feedback

2393a0e

refactor: rename TestDecode to TestStatement_UnmarshalJSON

661b0eb

knqyf263 approved these changes Aug 8, 2022

View reviewed changes

knqyf263 merged commit 317a026 into aquasecurity:main Aug 8, 2022

otms61 deleted the scan_sbom_attest branch August 8, 2022 14:03

otms61 restored the scan_sbom_attest branch August 27, 2022 09:44

ChristianCiach mentioned this pull request Feb 3, 2023

Feature: Provide an easier way to retrieve SBOM from In-Toto attestation sigstore/cosign#2307

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(sbom): add support for scanning a sbom attestation #2652

feat(sbom): add support for scanning a sbom attestation #2652

otms61 commented Aug 2, 2022 •

edited

Loading

knqyf263 Aug 3, 2022

otms61 Aug 3, 2022

knqyf263 Aug 3, 2022 •

edited

Loading

otms61 Aug 3, 2022

knqyf263 commented Aug 4, 2022

otms61 commented Aug 4, 2022

knqyf263 Aug 8, 2022

otms61 Aug 8, 2022

knqyf263 Aug 8, 2022

otms61 Aug 8, 2022

knqyf263 Aug 8, 2022

otms61 Aug 8, 2022

ChristianCiach commented Feb 15, 2023 •

edited

Loading

knqyf263 commented Feb 15, 2023

-	if _, found := st.Predicate.(map[string]interface{})["Data"]; found {
+	if cosignPredicate, ok := st.Predicate.(map[string]interface{}); ok {
+		data, found := cosignPredicate["Data"]
+		if !found {
+			return Statement{}, xerrors.Errorf("unsupported predicate format")
+		}
+		st.CosignPredicateData = data

	predicateByte, err = json.Marshal(attest.CosignPredicateData)
	if err != nil {
	return sbom.SBOM{}, xerrors.Errorf("failed to marshal predicate: %w", err)
	}

		sbom.cdx.intoto.jsonl (alpine 3.7.3)

		Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 2)

	func TestDecode(t *testing.T) {
	func TestStatement_UnmarshalJSON(t *testing.T) {

feat(sbom): add support for scanning a sbom attestation #2652

feat(sbom): add support for scanning a sbom attestation #2652

Conversation

otms61 commented Aug 2, 2022 • edited Loading

Description

Related issues

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knqyf263 Aug 3, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knqyf263 commented Aug 4, 2022

otms61 commented Aug 4, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ChristianCiach commented Feb 15, 2023 • edited Loading

knqyf263 commented Feb 15, 2023

otms61 commented Aug 2, 2022 •

edited

Loading

knqyf263 Aug 3, 2022 •

edited

Loading

ChristianCiach commented Feb 15, 2023 •

edited

Loading